10 minhigh
A Study of Thanos Ransomware Variants | Zscaler Blog
Thanos ransomware, a C#/.NET-based RaaS platform whose builder source code leaked, spawned at least four double-extortion variants in 2021: Prometheus, Haron, Spook, and Midas. All variants share common signatures including the 'GotAllDone' file marker appended to encrypted files and key identifiers in ransom notes. The latest variant, Midas, terminates security and backup services, deletes shadow copies, disables the Raccine anti-ransomware tool, encrypts files using Salsa20 with RSA-wrapped keys, and maintains persistence via a startup LNK file.
Sens:▲ 24hConf:high
Showing defanged values
- filenamereload1.lnkPersistence LNK file dropped to Windows Startup folder to re-open ransom note at every restart
- filenameRESTORE_FILES_INFO.htaHTA ransom note dropped by all Thanos variants after encryption; does not contain Key ID
- filenameRESTORE_FILES_INFO.txtRansom note dropped by all Thanos variants (Prometheus, Haron, Spook, Midas) after encryption; contains Key ID
- md53767a7d073f5d2729158578a7006e4c4MD5 hash of Midas ransomware sample analyzed by Zscaler ThreatLabz
- registry_keyHKEY_CURRENT_USER\SOFTWARE\KEYID\myKeyIDRegistry location where Midas stores the encrypted Salsa20 encryption key after file encryption
Detection / Hunteropenrouter
What Happened
A family of ransomware called Thanos has been used to create multiple new variants over the course of 2021, each operated by different criminal groups but sharing the same underlying code. These variants (Prometheus, Haron, Spook, and Midas) all encrypt victims' files and threaten to publish stolen data online unless a ransom is paid. The Midas variant, which appeared in October 2021, is particularly aggressive: it shuts down antivirus software, backup tools, and even a free anti-ransomware tool called Raccine before encrypting files. Organizations running Windows systems with databases or backup software are at risk. Defenders should ensure backup solutions are resilient to service termination, monitor for unusual process shutdowns, and verify that endpoint protection cannot be easily disabled by malware.
Key Takeaways
- Thanos ransomware builder source code leaked, enabling multiple variants (Prometheus, Haron, Spook, Midas) with shared signatures including the 'GotAllDone' file marker and common ransom note key identifiers
- All four 2021 variants employ double extortion tactics with dedicated data leak sites; Midas may be linked to Haron operators based on shared victim data on leak sites
- Midas variant terminates security tools, database services, backup software, and the Raccine anti-ransomware tool before encrypting files using Salsa20 with RSA-encrypted keys
- Midas establishes persistence via a startup folder LNK file (reload1.lnk) and stores encryption keys in the registry under HKEY_CURRENT_USER\SOFTWARE\KEYID\myKeyID
- Midas deletes shadow copies via PowerShell and reboots systems into safe boot mode to bypass antivirus detection during encryption
Affected Systems
- Microsoft Windows systems (all versions supporting .NET framework)
- Systems running security products from McAfee, Symantec, Sophos, ESET, Kaspersky, Trend Micro, and Windows Defender
- Systems running database software (MS SQL Server, MySQL, Oracle, PostgreSQL)
- Systems running backup software (Veeam, Backup Exec, Acronis, NetBackup)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attacker deploys Midas ransomware, potentially using PowerShell scripts and remote access tools over a slow deployment period
- Defense Evasion: Malware reboots system into safe boot mode to bypass antivirus detection
- Discovery & Disablement: Terminates security products, database services, backup software, and analysis tools via taskkill.exe; stops related Windows services via net stop
- Defense Evasion: Deletes Raccine anti-ransomware tool process, registry keys, and scheduled tasks
- Impact: Deletes shadow copies via PowerShell WMI to inhibit recovery
- Encryption: Encrypts files using Salsa20 with RSA-wrapped keys, appends Base64-encoded key and 'GotAllDone' marker to each file, stores key in registry, drops ransom notes and persistence LNK
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Zscaler Cloud Sandbox, Zscaler Threat Library
Zscaler Cloud Sandbox provides behavioral detection and classification for Thanos variants (Win32.Ransom.Thanos, Win32.Ransom.Prometheus, Win32.Ransom.Spook, Win32.Ransom.Haron, Win32.Ransom.Midas). Detection signatures are available at Zscaler's Threat Library portal (threatlibrary.zscaler.com). No YARA, Sigma, Snort, or Suricata rules are provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR should capture process creation events for taskkill.exe, sc.exe, reg.exe, schtasks.exe, and powershell.exe shadow copy deletion. However, if the system is in safe boot mode, EDR agents may not be running, reducing visibility during the encryption phase. |
| Network Visibility | Low | The article does not describe significant network C2 communication for Midas. The ransomware operates primarily locally for encryption. Network visibility would mainly capture the initial deployment phase using remote access tools. |
| Detection Difficulty | Moderate | The use of standard Windows utilities (taskkill, sc, reg, schtasks, powershell) for defense evasion is detectable via process monitoring. The 'GotAllDone' file marker and RESTORE_FILES_INFO ransom notes provide reliable post-compromise indicators. However, safe boot mode operation may bypass EDR coverage, and the slow deployment approach may blend with legitimate administrative activity. |
Required Log Sources
- Windows Security Event Log (Event ID 4688 - Process Creation)
- Windows System Event Log (Service control events)
- PowerShell Script Block Logging (Event ID 4104)
- Windows Registry monitoring (Sysmon Event ID 12, 13, 14)
- Windows Task Scheduler logs
- EDR process telemetry and file creation events
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for systems where taskkill.exe is invoked to terminate multiple security product, backup, or database processes in a short time window, which may indicate ransomware preparation. | EDR process creation events, Windows Security Event Log 4688 | Defense Evasion | Medium — legitimate administrative scripts may terminate services, but bulk termination of security products is unusual. |
| Consider hunting for files containing the 'GotAllDone' marker at the end of file content, which is a unique signature of Thanos-derived ransomware variants. | EDR file write events, file integrity monitoring | Impact | Low — this string is specific to Thanos ransomware family. |
| Consider hunting for LNK files created in the Windows Startup folder, particularly reload1.lnk, which may indicate Midas ransomware persistence. | EDR file creation events, Sysmon Event ID 11 (File Create) | Persistence | Low — legitimate applications rarely create LNK files in the Startup folder with this naming pattern. |
| Consider hunting for registry modifications under HKEY_CURRENT_USER\SOFTWARE\KEYID, which is used by Midas to store encryption keys. | Sysmon Event ID 12/13 (Registry add/set), EDR registry monitoring | Impact | Low — this registry path is not associated with legitimate software. |
| Consider hunting for systems where net stop or sc.exe config commands are used to disable a large number of security, backup, and database services simultaneously, which may indicate ransomware staging. | EDR process telemetry, Windows System Event Log | Defense Evasion | Medium — patch management or maintenance windows may involve service stops, but bulk disabling of security products is suspicious. |
Control Gaps
- Systems booted in safe mode may not have EDR or AV agents running, creating a blind spot during the encryption phase
- Standard Windows utilities (taskkill, sc, reg, schtasks, powershell) used for defense evasion may not trigger signature-based AV detection
- Slow deployment over weeks may evade time-based correlation rules that expect rapid ransomware execution
Key Behavioral Indicators
- Process ancestry showing taskkill.exe terminating multiple security and backup processes in sequence
- File marker 'GotAllDone' appended to encrypted files
- Creation of RESTORE_FILES_INFO.txt and RESTORE_FILES_INFO.hta in multiple directories
- Creation of reload1.lnk in the Windows Startup folder
- Registry key creation under HKEY_CURRENT_USER\SOFTWARE\KEYID\myKeyID
- PowerShell WMI shadow copy deletion command execution
- Bulk service stops targeting security, backup, and database services
- Deletion of Raccine-related registry keys and scheduled tasks
False Positive Assessment
Low — the 'GotAllDone' file marker, RESTORE_FILES_INFO ransom notes, and reload1.lnk persistence file are highly specific to Thanos-derived ransomware. Process-based detections for bulk security product termination carry moderate false positive risk from legitimate administrative activity.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint telemetry for the MD5 hash 3767a7d073f5d2729158578a7006e4c4 and the 'GotAllDone' file marker across all endpoints.
- If your EDR supports it, consider deploying behavioral rules to alert on bulk taskkill.exe invocations targeting security and backup processes.
- Consider checking for the presence of reload1.lnk in Windows Startup folders and RESTORE_FILES_INFO.* ransom notes across file shares and endpoints.
Infrastructure Hardening
- Evaluate whether your backup solution supports immutable or offline backups that cannot be terminated via service stops.
- Consider implementing Windows service hardening policies that prevent non-administrator accounts from stopping security-related services.
- If applicable, evaluate whether safe boot mode can be restricted or monitored via group policy to prevent malware from leveraging it for AV bypass.
- Consider monitoring for bulk service stop commands targeting backup, database, and security services as a ransomware early warning signal.
User Protection
- Consider ensuring endpoint protection agents are configured to resist termination attempts and can operate in safe boot mode where supported.
- If using the Raccine anti-ransomware tool, consider monitoring for attempts to delete its registry keys, scheduled tasks, or process.
- Evaluate whether your organization's PowerShell logging captures WMI shadow copy deletion commands.
Security Awareness
- Consider incorporating awareness of slow-deploying ransomware into existing training programs, emphasizing that attackers may operate over weeks before triggering encryption.
- If applicable, consider training IT staff to recognize suspicious service stop patterns and report them to security teams.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Persistence
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Discovery
Additional IOCs
- Registry Keys:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Raccine Tray- Registry value deleted by Midas to disable the Raccine anti-ransomware toolHKCU\Software\Raccine- Registry key deleted by Midas to remove Raccine anti-ransomware tool configuration
- File Paths:
C:\Users\{Username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk- Startup folder path where Midas drops reload1.lnk for persistence
- Command Lines:
- Purpose: Terminate Raccine anti-ransomware tool process | Tools:
taskkill.exe| Stage: Defense Evasion |taskkill /F /IM RaccineSettings.exe - Purpose: Delete Raccine registry run key to prevent auto-start | Tools:
reg.exe| Stage: Defense Evasion - Purpose: Delete Raccine scheduled task for rules updates | Tools:
schtasks.exe| Stage: Defense Evasion |schtasks /DELETE /TN "Raccine Rules Updater" /F - Purpose: Delete shadow copies to inhibit system recovery | Tools:
powershell.exe,WMI| Stage: Impact - Purpose: Modify service start type to disabled for SQL and telemetry services | Tools:
sc.exe| Stage: Defense Evasion |sc.exe config <servicename> start= disabled - Purpose: Modify service start type to auto for network discovery services | Tools:
sc.exe| Stage: Defense Evasion |sc.exe config <servicename> start= auto
- Purpose: Terminate Raccine anti-ransomware tool process | Tools:
- Other:
GotAllDone- File marker appended at the end of each encrypted file by all Thanos variants (Prometheus, Haron, Spook, Midas)
